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DETAILED ACTION 

Claim Objection 

1 . Claim 2 recites the limitation "the virus" in line 1 . There is insufficient antecedent 
basis for this limitation in the claim. 

Claim Rejections - 35 USC § 101 

2. The following is a quotation of the 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

3. Claims 10-18 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

4. With regard to claims 10-18, the claims are directed to software product per se 
without being stored in a computer readable medium, which constitutes non- 
statutory subject matter. 

Claim Rejections - 35 USC §112 

5. The following is a quotation of the second paragraph of 35 U.S.C. 112: 



The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 



Application/Control Number: 10/683,584 Page 3 

Art Unit: 2196 

6. Claim 2 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

7. With regard to claim 2, the phrase "the virus" in line 1 is not clearly understood 
that it is referring to the selected computer virus or any other computer virus; thus 
rendering the corresponding claims vague and indefinite. For the purpose of 
examination, the phrase "the virus" in line 1 of claim 2 would be treated as the 
"selected computer virus". 

Claim Rejections - 35 USC § 102 

8. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

9. Claims 1, 3, 10, and 12 are rejected under 35 U.S.C. 102(b) as being anticipated 
by White et al. ("Anatomy of a Commercial-Grade Immune System, IBM Research 
White Paper, 1999, 

http://www.research.ibm.com/antivirus/SciPapersA/Vhite/Anatomy/Anatomy.PDF), 
hereafter 'White". 
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10. With regard to claim 1 , White discloses a distributed network having a number of 
server computers and associated client devices (Fig. 2), method of creating an 
anti-computer virus agent, comprising: 

parsing a selected computer virus (section "Immune System architectural 
overview" page 10, paragraph 1 , lines 3-4, analyze a new or previously unknown 
virus reads on parsing a selected computer virus); and based upon the parsing 
(section "Virus Analysis" page 13, lines 1-3, use the result of this analysis reads 
on based upon the parsing). 

modifying the parsed virus (section "Virus Analysis", page 13, lines 1-3, create a 
test and cure for the new virus reads on modifying the parsed virus) to repair 
those client devices infected by the selected virus (section "Cure Distribution", 
page 13, lines 1-4). 

1 1 . With regard to claims 3 and 12, White further discloses the detection module 
identifies a selected one of the client devices as a target client device (section 
"Cure Distribution", page 13, first paragraph, lines 1-2, update is returned to the 
client that reported the initial infection or other devices in the system). 

12. With regard to claim 10, White discloses a computer program product (section 
"download floods", page 8, Iine4, anti-virus software reads on computer code) for 
creating an anti-computer virus agent, comprising: 
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computer code (section "download floods", page 8, Iine4, anti-virus software 
reads on computer code) for parsing a selected computer virus (section "Immune 
System architectural overview" page 10, paragraph 1, lines 3-4, analyze a new or 
previously unknown virus reads on parsing a selected computer virus); and 
based upon the parsing (section "Virus Analysis" page 13, lines 1-3, use the 
result of this analysis reads on based upon the parsing).. 

computer code (section "download floods", page 8, Iine4, anti-virus software 
reads on computer code) modifying the parsed virus (section "Virus Analysis", 
page 13, lines 1-3, create a test and cure for the new virus reads on modifying 
the parsed virus) to repair those client devices infected by the selected virus 
(section "Cure Distribution", page 13, lines 1-4). 

Claim Rejections - 35 USC § 103 

13. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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14. Claims 2, 4-6, 11, and 13-15 are rejected under 35 USC 103(a) as being 
unpatentable over White and in view of Cass ("Anatomy of Malice", Spectrum 
IEEE, Nov. 2001, vol. 35, issue 11, pages: 56-60), hereafter "Cass". 

15. With regard to claims 2 and 1 1 , White does not disclose the virus is formed of a 
detection module, an infection module, and a viral code payload module. 

However, Cass discloses the virus is formed of a detection module (section 
"Under the Skin", paragraph 10, lines 6-7), an infection module (section "Under 
the Skin", paragraph 6, lines 1-3), and a viral code payload module (section 
"Under the Skin", paragraph 8, lines 3-6). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicants invention was made to combine the teachings of White and teaching 
of Cass to provide an effective defenses by understand the cause and 
mechanism of infection (Cass, page 56, paragraph 5, lines 1-3). 

16. With regard to claims 4 and 13, White discloses those infected target client 
devices (section "Virus Detection", page 11, second paragraph, lines 1-2) but 
White does not disclose the infection module causes the virus to infect those 
target client devices not infected by the selected virus. 
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However, Cass discloses the infection module causes the virus to infect (section 
"Under the skin", page 57, paragraph 6, lines 1-3, invaded Word's default 
template reads on virus to infect) those target client devices not infected by the 
selected virus (section "Under the skin", page 58, paragraph 10, lines 2-4). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White and teaching 
of Cass to provide an effective defenses by understand the cause and 
mechanism of infection (Cass, page 56, paragraph 5, lines 1-3). 

17. With regard to claims 5 and 14, White does not disclose the viral code payload 
module includes viral code that infects the targeted client device. 

However, Cass discloses the viral code payload module includes viral code that 
infects the targeted client device (section "Source of Mischief, page 59, last 
section with component "Payload", section "Under the skin", page 58, paragraph 
8, lines 3-6). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White and teaching 
of Cass to provide an effective defenses by understand the cause and 
mechanism of infection (Cass, page 56, paragraph 5, lines 1-3). 
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18. With regard to claims 6 and 15, White does not disclose modifying the infection 
module to infect those computers already infected by the selected virus. 

However, Cass discloses the modifying the infection module (section "Under the 
Skin, page 57, paragraph 7, lines 1-4, "triggering Melissa which copied itself..." 
reads on modifying the infection module) to infect those computers already 
infected by the selected virus (section "Evolution of a sickness", page 56, 
paragraph 4, lines 6-8). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White and teaching 
of Cass to provide an effective defenses by understand the cause and 
mechanism of infection (Cass, page 56, paragraph 5, lines 1-3). 

19. Claims 7-9, and 16-18 are rejected under 35 USC 103(a) as being unpatentable 
over White, in view of Cass, and further in view of Maher, III et al. (US. Pat. No. 
6910134), hereafter "Maher. 

20. With regard to claims 7 and 16, neither White nor Cass discloses incorporating 
inoculation viral code in the payload module that acts to prevent further infection 
by the selected virus. 
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Maher, on the other hand disclose incorporating inoculation viral code in the 
payload module (col. 10, lines 52-55, modifying bits of data packets reads on 
inoculation viral code in the payload module) that acts to prevent further infection 
by the selected virus (col. 10, lines 65-67). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White, Cass and 
teaching of Maher to scan network traffic at wire speeds, recognized emails 
potentially infected with viruses, and inoculate any attachment such that any 
virus in the attachment is destroyed (Maher, col. 1, lines 40-42). 

21 . With regard to claims 8 and 1 7, White discloses a repair viral code for the 

infected client device caused by the selected virus (section "Cure Distribution", 
page 13, paragraph 1 , virus definition reads on repair viral code, and update 
returned to client that reported the initial infection reads on infected client) but 
does not disclose the payload module. 

On the other hand, Cass discloses a payload module (section "Under the skin", 
page 58, paragraph 8, lines 3-6). 
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It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White and teaching 
of Cass to provide an effective defenses by understand the cause and 
mechanism of infection (Cass, page 56, paragraph 5, lines 1-3). 

However, neither White nor Cass discloses incorporating repair viral code in the 
payload module that acts to repair any damage in the infected client device 
caused by the selected virus. 

Maher, however, discloses incorporating repair viral code in the payload module 
(col. 10, lines 52-53, changing bits in the data packets reads on incorporating 
repair viral code in the payload) that acts to repair any damage in the infected 
client device caused by the selected virus (col. 10, lines 65-67, attachment will be 
unreadable reads on repair any damage in the infected client). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White, Cass and 
teaching of Maher to scan network traffic at wire speeds, recognized emails 
potentially infected with viruses, and inoculate any attachment such that any 
virus in the attachment is destroyed (Maher, col. 1 , lines 40-42). 
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22. With regard to claims 9 and 18, White discloses forming the anti-viral agent 

(section "Immune System Architectural Overview", page 10, paragraph one, lines 
3-4) but does not disclose by combining the detection module, the modified 
infection module and the modified viral payload module. 

Cass, on the other hand, discloses combining the detection module (section 
"Source of Mischief, page 59, second section, component "check whether 
computer is already infected by Mellisa", reads on detection module), the 
modified infection module (section "Under the Skin, page 57, paragraph 7, lines 
1-4, "triggering Melissa which copied itself..." reads on modifying the infection 
module), and the viral payload module (section "Source of Mischief, page 59, 
third section, component "Payload"). 

It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White and teaching 
of Cass to provide an effective defenses by understand the cause and 
mechanism of infection (Cass, page 56, paragraph 5, lines 1-3). 

However, neither White nor Cass discloses the modified viral payload module. 
On the other hand, Maher discloses the modified payload module (col. 10, lines 
52-57, changing the bits of an attachment to render the attachment harmless 
reads on modified payload). 
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It would have been obvious to one of the ordinary skill in the art at the time of the 
applicant's invention was made to combine the teachings of White, Cass and 
teaching of Maher to scan network traffic at wire speeds, recognized emails 
potentially infected with viruses, and inoculate any attachment such that any 
virus in the attachment is destroyed (Maher, col. 1, lines 40-42). 

Conclusion 

23. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. US. Pat. No. 5485575 to Chess et al. (Discloses extracting, sampling, and 
analyzing how computer virus attaches to a host program.) 

b. US. PGPub. No. 2004/0148281 to Bates et al. (Discloses virus checking 
database which use part of virus status information as searching criteria). 

c. US. Pat. No. 5832208 to Chen et al. (Discloses agent for detecting and 
removing e-mail attachment that infected with virus). 

d. Vesselin Bontchev,, Are "Good" Computer Viruses Still a Bad Ideas?, 
Proceeding El CAR 1994 Conference, Pages: 25-47. 

e. Stephanie Forrest et al., "Computer Immunology", Communications of the 
ACM, October 1997, Vol. 40. No. 10. pages: 88-96. 
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2. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Khoi Nguyen whose telephone number is 570-270-1251. 
The examiner can normally be reached on M-Fri (7:30-5:00) Fri (7:30 - 4:00). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nabil E. El Hady can be reached on 571-272-3963. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

KN r 

Khoi Nguyen 

PRIMARY PATENT EXAMINER 




